CVE-2022-28386 Security feature bypass in n/a
Attackers can bypass the lockout mechanism on Verbatim secure drives, allowing unlimited password attempts to access protected data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-28386?
CVE-2022-28386 is a medium-severity vulnerability in n/a, published on 8 Jun 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in certain Verbatim drives through 2022-03-31. The security feature for lockout (e.g., requiring a reformat of the drive after 20 failed unlock attempts) does not work as specified. More than 20 attempts may be made. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428 and Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0.
Weakness: CWE-307
Which versions are affected by CVE-2022-28386?
It affects 2 products.
Products include Verbatim Gd25lk01-3637-C Firmware, Verbatim Keypad Secure Usb 3.2 Gen 1 Firmware.
How do I fix CVE-2022-28386?
No fix has been published for CVE-2022-28386 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-28386 being exploited?
There is no known exploitation of CVE-2022-28386 in the wild and no public exploit code.
Sources
Also known as GHSA-m5cp-32qg-99gf.